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DPC’s approach to Domestic CCTV 





The prevalence of the use of recording devices by private individuals to protect their 
homes and property (including CCTV and smart doorbells) raises a number of 
challenges for the regulation of the processing of personal data by the operators of 
these devices. This also reflects wider societal issues associated with the accessibility to, 
and the usage of, surveillance technology by private individuals who may not appreciate 
their obligations in relation to the rights of others, including privacy and data protection 
rights. The purpose of this document is to set out the Data Protection Commission's 
general approach to complaints from individuals relating to the operation of domestic 
CCTV. This approach is grounded in the DPC’s forthcoming Regulatory Strategy 2022 - 
2027 and reflects the DPC’s assessment of the most appropriate way to handle 
complaints of this nature having regard to the risks posed to data subjects and the 
application of the DPC’s resources. 


Leaving aside issues of privacy - which can be pursued through the civil or criminal 
courts - the starting point from a data protection regulator's perspective is whether the 
processing of personal data by these devices comes within the scope of the GDPR or 
not. This is because of the household exemption under Article 2(2)(c) of the GDPR. The 
exemption applies where personal data is processed by a natural person in the course 
of a purely personal or household activity. This means that if you only use personal 
data for such things as writing to friends and relatives, keeping address books or certain 
social networking, where these activities are purely personal, you are not subject to the 
GDPR. In the sphere of CCTV, this would generally mean that as long as the images 
captured are within the perimeter of your own home and are only used for your 
personal purposes, the exemption is likely to apply. However, where your device 
Operates in such a way as to capture images of people outside the perimeter of your 
home (in public spaces or in neighboring property), you are no longer able to avail of 
the domestic exemption. In those circumstances, you must either change the way you 
use the device to capture images only within your property or comply with data 
protection law. This follows from the decision of the Court of Justice of the European 
Union in the case of Rnyes (C 212/13), which found that the household exemption did 
not apply where a domestic CCTV system captured images in the street outside the 
private property. 


The DPC advises all householders to operate their devices in a way that only captures 
images within the perimeter of their own property to avoid complaints about the use of 
these devices to the DPC or expose operators to civil or criminal proceedings from 
those affected. 


The DPC has already examined a significant number of complaints relating to the use of 


domestic CCTV by individuals. For the most part, these complaints are mainly about 





neighbours who operate a CCTV system or smart doorbell. Over the past year, the DPC 
has handled over 150 complaints alone on this issue. Most of these cases have involved 
extensive engagement by the DPC where ultimately it was confirmed that the domestic 
exemption applied before the complaint was lodged. In the remainder of cases, the DPC 
works with the operator to try to bring about a position where the CCTV operator comes 
within the exemption. This is particularly so where wider issues are at play and where 
data protection is not at the core of the dispute. While each case turns on its own facts, 
a number of common themes emerge: 


- Disputes tend to be about wider issues between neighbours often involving 
allegations of assault, trespass or anti-social behaviour and frequently involving 
An Garda Siochana. 


- Often the dispute is tied up with legal issues such as a dispute over a right of way 
or title to land. 


- Disputes around the use of cameras in multi-development units usually with 
Shared entrances or where parking spaces are not adjacent to the home. 


- The use of dummy cameras, which do not give rise to data protection issues or 
cameras that are masked so that they only capture images within the owner's 


property. 


- Challenges around the DPC exercising its powers against private individuals 
within their private dwellings. 


DPC approach 


The obligation of the DPC under both the GDPR and the Data Protection Act 2018 is to 
handle complaints lodged with it to the extent appropriate and take such action 
as is appropriate having regard to the nature and circumstances of the complaint. 
In doing so, the DPC must have regard to the particular facts of the case, the overall use 
of its resources within the context of the thousands of complaints it receives annually 
and the public policy considerations in relation to the deployment of its resources and 
powers against private individuals (Such as inspection in a domestic setting) in cases 
which usually involve wider disputes (and may already be the subject of complaints to 
An Garda Siochana or before the courts). 


With that mind, and in line with the DPC’s forthcoming Regulatory Strategy 2022 - 2027, 
the DPC’s general approach to these complaints will be as follows (and will be based on 
the facts of each individual case): 


- Toassess the complaint to determine if there is evidence of the processing of 
personal data: where there is no such evidence or where the operator satisfies 





the DPC that the camera in question is either not operating or is operating within 
the personal or household exemption, GDPR does not apply and no further 
steps are required. 


- Where the case involves disputed rights of way or land boundaries, the DPC 
cannot make finding of facts in relation to such matters so it is not possible to 
determine if the personal or household exemption applies. In those cases, no 
further action will be taken by the DPC until the legal dispute is determined by 
the appropriate authority and if processing continues after that point. 


- Where there is evidence of personal data processing, the DPC will engage with 
the parties to try to resolve the matter by advising the operator to bring their 
devices into line with the domestic exemption. 


- Where this is not successful and the circumstances of the case indicate a camera 
operating that is bound up in other issues between private individuals such as 
use and access to shared entrances and common areas, anti-social behaviour, 
allegations of harassment, nuisance, assault, threatened assault or damage to 
property, the DPC will usually attempt to identify the relevant data protection 
issue(s) for the parties and provide appropriate advice. 


- It will be open to an individual to rely on this advice in the context of how they 
deal with the wider issues in dispute. 


This is a general approach of the DPC and will be determined on the facts of any given 
case. From the DPC’'s experience to date, many of these cases are neighbour disputes 
and would be better addressed through mediation as a more appropriate channel to 
address these wider issues. The DPC does not provide a mediation service and 
individuals should consult appropriate mediation services some of which are provided 
on a free of charge basis. 


Case Study 1: Public areas and consenting neighbours 





The complainant submitted a complaint against a neighbour as they were concerned 
that their neighbour's cameras were capturing the public road and footpath that the 
complainant used on a daily basis. 


Upon examination by the DPC it transpired that the CCTV operator was capturing the 
public road, footpath and public green at the front of their property and a neighbouring 
property at the back. The DPC provided the operator with guidance on the operation of 
Domestic CCTV and requested the operator adjust the angles of their cameras or apply 
privacy zones so that they are no longer capturing public areas and neighbouring 
properties. 





The operator provided the adjusted footage clearly showing that the front camera was 
now only capturing footage from within the perimeter of their property and they also 
provided consent from their neighbour to continue to capture their back garden, as that 
neighbour was concerned about their security. The DPC advised the operator that the 
neighbour may withdraw this consent at any time and in such case the operator must 
cease operating the cameras in this manner immediately. 


The complaint was concluded on the basis that the Domestic CCTV system is now in 
compliance with Article 2(2)(c) of the GDPR and the operator has consent from the 
affected neighbour to capture this footage outside the perimeter of the operator's 


property. 





Case Study 2: Dummy camera 


The complainant submitted a complaint against a neighbour claiming that they were 
capturing them with their cameras as they entered and exited their own property. 


Upon examination by the DPC, it transpired that the complainant no longer resided 
next door to the CCTV operator but there were ongoing civil proceedings. The operator 
also alleged that the complainant had destroyed a previous camera and was caught 
prowling on their property. Notwithstanding this, the operator replaced the camera 
with a dummy camera and found this sufficient to deter the complainant from entering 
their property again. 


The complaint was concluded on the basis that there was no evidence of processing of 
personal data. 





Case Study 3: Cameras in compliance with legislation 


The complainant submitted a complaint against their neighbour alleging that the entire 
CCTV system, made up of multiple cameras, was capturing their personal data. 


Upon examination by the DPC it transpired that although the cameras were slightly 
directed towards the complainant's property, the lens of the cameras was not capturing 
any of the complainant's property or their personal data. 


The complaint was concluded on the basis that the Domestic CCTV system is operated 
in compliance with Article 2(2)(c) of the GDPR. 





